Wane.The ways agents get drained keep mutating: poisoned tools, fresh drainers, redeployed contracts. Wane gives every agent a living immune system, and an on-chain policy firewall to back it: spend caps, allowlists, and a kill switch that revert a bad action before value moves. The moment one agent is hit, the threat becomes an antibody the whole network carries, so the next agent is already immune.
AI agents keep meeting the same attack for the first time. Nothing one agent learns is shared, so a single drainer can empty a thousand wallets in a row. Wane turns the network into an immune system. The first agent hit by a threat records it on-chain as an antibody that every agent after it already carries, and the antibody follows the threat by its code and behavior as it mutates. Every attack widens the shared memory, so the network gets harder to drain the more it is attacked.
When one agent gets drained, the threat becomes an antibody every other agent carries before it signs, so the attack that emptied one wallet stops at the next. The threat wanes.
A single antibody pins a flagged address to its contract codehash and a call pattern. Any agent queries check() for free before it signs, gets back a verdict, and skips the malicious call. Reading costs nothing, so reading is immunity.
An agent gets drained by a poisoned tool. It mints an on-chain antibody, a threat record pinned to the flagged address and contract codehash, and stakes $WANE behind it. Every other agent reads check() for free before it signs, so the second attempt reverts before any value moves. False records get challenged and the publisher slashed.
One agent records a threat as an antibody. Every other agent reads it and is protected from the same attack.
Enroll a bot and pick what Wane blocks: per-tx and daily spend caps, function-selector and token allowlists, kill switch, TTL, and blocklist. All enforced in-contract, so a flagged action reverts before value moves.
Checking the registry is a free view call. An agent reads before it signs, so staying protected costs nothing.
An attacked agent records the threat once as an antibody, naming the bad address, its contract bytecode hash, or a call pattern. Every other agent reads that verdict before it signs.
Every antibody is backed by staked $WANE. Anyone can challenge a false one inside the window, and if it is overturned the publisher is slashed and the challenger paid.
An agent enrolls a policy: which threats to block, spend caps, a kill switch. Actions routed through its EIP-7702 delegate are screened against that policy on-chain, and a flagged target reverts before any value moves.
For custody-grade protection, funds live inside a non-custodial WaneVault we built ourselves. Only the owner drives it, every outbound send is screened against the policy on-chain, and a flagged recipient reverts before value moves. No raw-send bypass, and the real ERC-20 recipient is decoded and screened too.
Wane is the registry they all read and write. One check call before signing, one mint call after an attack, one policy that the SDK and the v4 hook enforce.
LangChain, AutoGPT, CrewAI, Eliza
Wrap every tool call with check() before the agent signs. One line in the SDK, malicious targets get refused automatically.
On-chain trading bots, DeFi copilots
Enroll the agent, set a spend cap and a block scope, and let the policy reject drains the owner never approved.
Tool registries, MCP server hosts
Read antibody verdicts to flag poisoned servers before they reach users. Surface a trust signal on every listing.
Embedded wallets, intent routers
Gate signing through the Uniswap v4 hook so a known drainer reverts at the contract level, not just in the UI.
Auditors, threat-intel teams
Publish confirmed drainers as staked antibodies, earn when they hold up, and put real cost on anyone who fakes them.
Any DAO running agents onchain
Point treasury agents at the shared registry so no single bot has to learn an attack the network already knows.
Every antibody is published with $WANE staked behind it, and anyone can challenge it inside the slashing window. A false record gets the publisher slashed and pays the challenger out of that stake. Lying costs more than it ever returns, so the cheap attack is to stay honest.
A blocklist is one company's list that you have to trust and that no agent can verify. Wane records live on-chain, carry stake, and can be challenged by anyone, so the memory stays honest without a gatekeeper. Markers go past addresses to contract codehash, call patterns, and semantic signals, so a redeploy does not dodge it.
check() is a single on-chain read with a free verdict, called before the agent signs. The genesis set already holds 652 known drainers. an agent is protected from the first call, not after it loses money.
You do. The owner enrolls an agent and picks a scope: which threat kinds to block, per-transaction and daily spend caps, allow and block lists, function selectors, and a sensitivity level. the SDK and a Uniswap v4 hook enforce that policy automatically on-chain, so a flagged or out-of-scope action reverts before it executes, and you decide the protection while Wane runs it.
There is no admin allowlist to capture. Records are open to publish, open to challenge, and resolved against on-chain evidence, so no single party can quietly insert or hide a threat. The economics, not a multisig, keep the memory clean.
The contracts are live onchain today, the SDK is published as wane-sdk on npm, and the whole stack is open source. Genesis is seeded with 652 known drainers from public lists, so the registry returns real verdicts on day one. Every claim here is a view call away: read the registry on-chain and check it yourself.